This vulnerability allows an attacker to inject arbitrary JavaScript code into the Chaty Pro plugin interface without requiring any authentication. An unauthenticated XSS flaw can be used to steal session cookies, hijack user accounts, deface sites, or provide a foothold for more advanced attacks. The injected code runs under the privileges of the victim user, meaning the impact can be scoped from a single visitor to a full WordPress site depending on user interaction.

WordPress sites that have the Chaty Pro plugin version 3.5.8 or earlier installed. The plugin is distributed by Premio under the name Premio:Chaty Pro. Any installation running one of these affected versions is susceptible.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability is unauthenticated and can be triggered by any user, making it relatively easy to exploit. It is not listed in the CISA KEV catalog at this time. Attackers can target the plugin’s public interface, bypassing authentication to inject malicious payloads.